Analysis
- max time kernel
71s - max time network
288s - platform
windows10-1703_x64 - resource
win10-20220901-en - resource tags
- submitted
06/12/2022, 22:26
General
- Target fb00f8583be5fdb2c0711ab318d319f58e37f6c177621f9c3132f209a6ae09d1.exe
- Size 4.6MB
- Sample221206-2cparsaa72
- SHA256 fb00f8583be5fdb2c0711ab318d319f58e37f6c177621f9c3132f209a6ae09d1
Malware Config
Extracted
-
laplas
-
clipper.guru
-
api_key
6421b2bdb6b1eebc6487e916bb1c79875fbc8da77152f9914b4aefb39a69f6d5
Signatures
- Laplas Clipper
Laplas is a crypto wallet stealer with two variants written in Golang and C#.
- Executes dropped EXE 1 IoCs
- Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
- GoLang User-Agent 1 IoCs
Uses default user-agent string defined by GoLang HTTP packages.
- Suspicious use of WriteProcessMemory 6 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\fb00f8583be5fdb2c0711ab318d319f58e37f6c177621f9c3132f209a6ae09d1.exe"C:\Users\Admin\AppData\Local\Temp\fb00f8583be5fdb2c0711ab318d319f58e37f6c177621f9c3132f209a6ae09d1.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.execmd.exe /C schtasks /create /tn JbBFjWcHIk /tr C:\Users\Admin\AppData\Roaming\JbBFjWcHIk\OEFGCBRcPg.exe /st 00:00 /du 9999:59 /sc once /ri 1 /f2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /tn JbBFjWcHIk /tr C:\Users\Admin\AppData\Roaming\JbBFjWcHIk\OEFGCBRcPg.exe /st 00:00 /du 9999:59 /sc once /ri 1 /f3⤵
- Creates scheduled task(s)
-
-
-
C:\Users\Admin\AppData\Roaming\JbBFjWcHIk\OEFGCBRcPg.exeC:\Users\Admin\AppData\Roaming\JbBFjWcHIk\OEFGCBRcPg.exe1⤵
- Executes dropped EXE
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
OEFGCBRcPg.exe
OEFGCBRcPg.exe
memory/776-167-0x0000000077B00000-0x0000000077C8E000-memory.dmp
memory/776-157-0x0000000077B00000-0x0000000077C8E000-memory.dmp
memory/776-151-0x0000000077B00000-0x0000000077C8E000-memory.dmp
memory/776-168-0x0000000077B00000-0x0000000077C8E000-memory.dmp
memory/776-166-0x0000000077B00000-0x0000000077C8E000-memory.dmp
memory/776-165-0x0000000077B00000-0x0000000077C8E000-memory.dmp
memory/776-164-0x0000000077B00000-0x0000000077C8E000-memory.dmp
memory/776-163-0x0000000077B00000-0x0000000077C8E000-memory.dmp
memory/776-162-0x0000000077B00000-0x0000000077C8E000-memory.dmp
memory/776-161-0x0000000077B00000-0x0000000077C8E000-memory.dmp
memory/776-152-0x0000000077B00000-0x0000000077C8E000-memory.dmp
memory/776-159-0x0000000077B00000-0x0000000077C8E000-memory.dmp
memory/776-158-0x0000000077B00000-0x0000000077C8E000-memory.dmp
memory/776-156-0x0000000077B00000-0x0000000077C8E000-memory.dmp
memory/776-155-0x0000000077B00000-0x0000000077C8E000-memory.dmp
memory/776-154-0x0000000077B00000-0x0000000077C8E000-memory.dmp
memory/776-160-0x0000000077B00000-0x0000000077C8E000-memory.dmp
memory/776-153-0x0000000077B00000-0x0000000077C8E000-memory.dmp
memory/3480-149-0x0000000077B00000-0x0000000077C8E000-memory.dmp
memory/3480-148-0x0000000077B00000-0x0000000077C8E000-memory.dmp
memory/3480-147-0x0000000077B00000-0x0000000077C8E000-memory.dmp
memory/3480-146-0x0000000077B00000-0x0000000077C8E000-memory.dmp
memory/3480-145-0x0000000077B00000-0x0000000077C8E000-memory.dmp
memory/3520-136-0x0000000077B00000-0x0000000077C8E000-memory.dmp
memory/3520-124-0x0000000077B00000-0x0000000077C8E000-memory.dmp
memory/3520-142-0x0000000077B00000-0x0000000077C8E000-memory.dmp
memory/3520-141-0x0000000077B00000-0x0000000077C8E000-memory.dmp
memory/3520-140-0x0000000077B00000-0x0000000077C8E000-memory.dmp
memory/3520-139-0x0000000077B00000-0x0000000077C8E000-memory.dmp
memory/3520-138-0x0000000077B00000-0x0000000077C8E000-memory.dmp
memory/3520-121-0x0000000077B00000-0x0000000077C8E000-memory.dmp
memory/3520-137-0x0000000077B00000-0x0000000077C8E000-memory.dmp
memory/3520-120-0x0000000077B00000-0x0000000077C8E000-memory.dmp
memory/3520-135-0x0000000077B00000-0x0000000077C8E000-memory.dmp
memory/3520-134-0x0000000077B00000-0x0000000077C8E000-memory.dmp
memory/3520-133-0x0000000077B00000-0x0000000077C8E000-memory.dmp
memory/3520-132-0x0000000077B00000-0x0000000077C8E000-memory.dmp
memory/3520-131-0x0000000077B00000-0x0000000077C8E000-memory.dmp
memory/3520-130-0x0000000077B00000-0x0000000077C8E000-memory.dmp
memory/3520-129-0x0000000077B00000-0x0000000077C8E000-memory.dmp
memory/3520-128-0x0000000077B00000-0x0000000077C8E000-memory.dmp
memory/3520-127-0x0000000077B00000-0x0000000077C8E000-memory.dmp
memory/3520-126-0x0000000077B00000-0x0000000077C8E000-memory.dmp
memory/3520-125-0x0000000077B00000-0x0000000077C8E000-memory.dmp
memory/3520-143-0x0000000077B00000-0x0000000077C8E000-memory.dmp
memory/3520-123-0x0000000077B00000-0x0000000077C8E000-memory.dmp
memory/3520-117-0x0000000077B00000-0x0000000077C8E000-memory.dmp
memory/3520-122-0x0000000077B00000-0x0000000077C8E000-memory.dmp
memory/3520-119-0x0000000077B00000-0x0000000077C8E000-memory.dmp
memory/3520-118-0x0000000077B00000-0x0000000077C8E000-memory.dmp
memory/3756-174-0x0000000077B00000-0x0000000077C8E000-memory.dmp
memory/3756-181-0x0000000077B00000-0x0000000077C8E000-memory.dmp
memory/3756-173-0x0000000077B00000-0x0000000077C8E000-memory.dmp
memory/3756-170-0x0000000077B00000-0x0000000077C8E000-memory.dmp
memory/3756-177-0x0000000077B00000-0x0000000077C8E000-memory.dmp
memory/3756-175-0x0000000077B00000-0x0000000077C8E000-memory.dmp
memory/3756-180-0x0000000077B00000-0x0000000077C8E000-memory.dmp
memory/3756-171-0x0000000077B00000-0x0000000077C8E000-memory.dmp
memory/3756-172-0x0000000077B00000-0x0000000077C8E000-memory.dmp
memory/3756-182-0x0000000077B00000-0x0000000077C8E000-memory.dmp
memory/3756-183-0x0000000077B00000-0x0000000077C8E000-memory.dmp
memory/3756-184-0x0000000077B00000-0x0000000077C8E000-memory.dmp
memory/3756-178-0x0000000077B00000-0x0000000077C8E000-memory.dmp
memory/3756-179-0x0000000077B00000-0x0000000077C8E000-memory.dmp